vidar | 3a95e1c2c599e7c27537e42713451e862dcd318660bbc11bbb45f1432f68499c

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 02:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mpclient.dll
Size 2.2MB
Sample261107-c74w9sty4m
SHA256 3a95e1c2c599e7c27537e42713451e862dcd318660bbc11bbb45f1432f68499c
MD5 fcfda692c84f930191c2b8b1adbcddb9
SHA1 cda8edd09090da67fc542a4f839135fc156363f0
SHA512 1cfeed102d75e4c7849e3954e2f57cec3719c319149c134d4921dd8e3d4ffef782285bc1496ca0f6680c197881ef5737b0aee4e562aca7a78b65da7cb0b014e2
SSDEEP 49152:WxurMreHHztGyjwxm/pzVuSI5wy+PYN633OlSR9mTeQi+O3d82AUsa:WAnj+0sa
TLSH
T1F0B58C0AACD008B6D46A53328CB752927B39F8180B7327D72E26A7782FF2BD05D75744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ef045f18455132bc2e22c24a3c41c8a9 defense_evasion discovery vidar spyware stealer trojan

Malware Config

Extracted

Family

vidar

Version

Botnet

ef045f18455132bc2e22c24a3c41c8a9

https://168.222.97.79
https://telegram.me/nwwfh8
https://steamcommunity.com/profiles/76561198719385745

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral9/memory/1212-1-0x0000000140000000-0x0000000140105000-memory.dmp	family_vidar_v15
behavioral9/memory/1212-41-0x0000000140000000-0x0000000140105000-memory.dmp	family_vidar_v15

Badlisted process makes network request 64 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
14	1212	rundll32.exe
16	1212	rundll32.exe
18	1212	rundll32.exe
19	1212	rundll32.exe
20	1212	rundll32.exe
22	1212	rundll32.exe
24	1212	rundll32.exe
25	1212	rundll32.exe
27	1212	rundll32.exe
29	1212	rundll32.exe
31	1212	rundll32.exe
33	1212	rundll32.exe
35	1212	rundll32.exe
41	1212	rundll32.exe
42	1212	rundll32.exe
43	1212	rundll32.exe
44	1212	rundll32.exe
45	1212	rundll32.exe
47	1212	rundll32.exe
52	1212	rundll32.exe
61	1212	rundll32.exe
62	1212	rundll32.exe
63	1212	rundll32.exe
65	1212	rundll32.exe
66	1212	rundll32.exe
67	1212	rundll32.exe
68	1212	rundll32.exe
69	1212	rundll32.exe
71	1212	rundll32.exe
72	1212	rundll32.exe
73	1212	rundll32.exe
74	1212	rundll32.exe
75	1212	rundll32.exe
79	1212	rundll32.exe
80	1212	rundll32.exe
83	1212	rundll32.exe
84	1212	rundll32.exe
85	1212	rundll32.exe
86	1212	rundll32.exe
87	1212	rundll32.exe
88	1212	rundll32.exe
89	1212	rundll32.exe
90	1212	rundll32.exe
92	1212	rundll32.exe
93	1212	rundll32.exe
94	1212	rundll32.exe
95	1212	rundll32.exe
96	1212	rundll32.exe
98	1212	rundll32.exe
99	1212	rundll32.exe
100	1212	rundll32.exe
101	1212	rundll32.exe
102	1212	rundll32.exe
104	1212	rundll32.exe
105	1212	rundll32.exe
106	1212	rundll32.exe
107	1212	rundll32.exe
108	1212	rundll32.exe
109	1212	rundll32.exe
110	1212	rundll32.exe
111	1212	rundll32.exe
112	1212	rundll32.exe
113	1212	rundll32.exe
114	1212	rundll32.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mpclient.dll,#1
1⤵
- Badlisted process makes network request
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
PID:1212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1212-0-0x0000000140000000-0x0000000140105000-memory.dmp

Download

memory/1212-1-0x0000000140000000-0x0000000140105000-memory.dmp

Download

memory/1212-40-0x00007FFAED000000-0x00007FFAED25E000-memory.dmp

Download

memory/1212-41-0x0000000140000000-0x0000000140105000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads